@across-protocol/contracts
5
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
chrismareemrice32nicholaspaievaldofelipe
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Package explicitly disables provenance in publishConfig; stable policy for this package. | ai | |
| dependencies | unvetted-dep:@openzeppelin/contracts-v4 | AI (dependencies): npm alias for @openzeppelin/[email protected] — well-known, audited library; stable for this package. | ai | |
| dependencies | unvetted-dep:@openzeppelin/contracts-upgradeable-v4 | AI (dependencies): npm alias for @openzeppelin/[email protected] — well-known, audited library; stable for this package. | ai | |
| dependencies | unvetted-dep:@across-protocol/constants | AI (dependencies): First-party constants package from the same Across Protocol org; stable dependency relationship. | ai | |
| phantom-deps | phantom-dep:@eth-optimism/contracts | AI (phantom-deps): Referenced in Solidity/config context, not JS imports. Stable false positive. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts | AI (phantom-deps): Solidity contract repo; OZ packages referenced in Foundry remappings/config, not JS imports. Stable pattern. | ai | |
| phantom-deps | phantom-dep:@scroll-tech/contracts | AI (phantom-deps): Referenced in Solidity/config context, not JS imports. Stable false positive. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts-v4 | AI (phantom-deps): Same as above — Foundry remapping reference, not a JS import. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts-upgradeable | AI (phantom-deps): Foundry remapping reference; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts-upgradeable-v4 | AI (phantom-deps): Foundry remapping reference; stable false positive for this package. | ai |